I have a relatively new instance on SSRS 2008R2 SP3 running on Windows Server 2008 R2. I am trying to set up separate domain service accounts for the separate SQL Services i.e. agent, engine, reporting, etc. I have done this successfully for the Agent and Engine services using simple Domain accounts and following the required permissions from docs.microsoft.com.
At first I had made local accounts for all services because of a video I watched that used that as an example. So now that I actually wanted to start using reporting services I switch the account to a newly created Domain account. Using the pertinent section in the above article I configured, via GPO, the account to have "Log On As A Service" right. I ensured that right is present in the groups I created.
I then went into the Reporting Services Configuration Manager to change the account which was successful except that the step for starting the service ended in error.
System.InvalidOperationException: Cannot start service ReportServer on computer 'SQLSERVER01'. ---> System.ComponentModel.Win32Exception: Access is denied --- End of inner exception stack trace --- at System.ServiceProcess.ServiceController.Start(String args) at System.ServiceProcess.ServiceController.Start() at ReportServicesConfigUI.Panels.ServerInformationPanel.StartStopServiceTask(Boolean start)
Event Viewer has a similar error which I include to save the questions.
The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: Access is denied.
So this is a Windows permission issue but I don't see what the problem could be since the Log On As a Service permissions are set correctly. That is verified by the security logs that show a successful logon of the account. If I make my service account a local admin on the server then the service starts correctly but I should not have to do that.